Live › vulnerability › CVE-2026-112853
Go to dashboardThe Hallelujah WordPress theme by axiomthemes unserializes untrusted data, so object injection is possible. The sources rate it critical (CVSS 9.8) and say it needs no login, so an attacker may be able to run code or take over the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| hallelujah | wordpress-theme | <= 1.1.1 | – |
Check the installed theme version in the WordPress admin under Appearance > Themes, or in style.css of the hallelujah theme directory; versions through 1.1.1 are affected.
1.1.1 or remove it; the sources do not name a fixed version, so check the vendor for the patched releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-112853")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.